rtificially inflated traffic is the fraud pattern that turned enterprise messaging procurement adversarial. The mechanics are simple: a script requests OTP verifications from an enterprise's public signup flow, pointed at mobile number ranges where some party in the delivery chain — an aggregator, a rogue reseller, occasionally an insider at a small operator — earns a share of the termination fee. The enterprise pays for real, delivered, entirely useless messages. The scale is not marginal: one global social platform publicly put its annual AIT losses at roughly $60 million when it moved to shut the traffic off in 2023, and industry bodies have since ranked AIT among the top revenue threats in A2P messaging. Every high-volume OTP sender now models for it; every operator and provider in the chain is expected to have an answer.
How the pump works
- The attacker finds an unauthenticated surface that triggers an SMS — a signup form, a login-with-phone flow, a resend-code endpoint — and automates requests against it.
- Target numbers are chosen from ranges the attacker monetises: a colluding party downstream earns per-message termination revenue, shared back to whoever generates the volume.
- The codes are never entered. Conversion on the affected ranges is effectively zero, but every message is billable and most are genuinely delivered.
- Volume is shaped to look plausible — spread across hours, mixed with organic traffic, rotated across ranges — precisely to defeat naive spike alerts.
The economics explain the persistence. International A2P termination in the affected corridors carries fees large enough that even a thin kickback share pays for the botnet many times over, and long aggregator chains give every intermediate party deniability about where the requests originated.
The detection signals that work
- Conversion collapse per destination range — the defining signature. Organic OTP conversion runs 70–95% depending on flow; AIT ranges sit near zero. Conversion must be measured per prefix, per operator, per corridor, not as a global average that dilutes the signal.
- Number-range clustering — bursts concentrated in narrow MSISDN prefixes, often ranges with little or no prior organic history against the enterprise's user base.
- Request-side fingerprints — signup attempts with datacenter IPs, headless-browser signatures, impossible geography (requests from one country, numbers from another with no user overlap), and velocity per IP or device that no human produces.
- Absent follow-through — no session creation, no app install, no subsequent activity from the 'verified' number. A verified user who never exists is the fraud, visible in the product analytics.
- HLR anomalies — numbers that fail HLR lookup, sit permanently unreachable, or belong to ranges reassigned to services rather than subscribers.
Detection needs both sides of the wire
The enterprise sees conversion and request-side telemetry; the provider and operator see routing, range behaviour, and cross-customer patterns — an AIT range burned on one enterprise reappears against another within days. Neither view is sufficient alone, which is why the effective deployments join them: the enterprise feeds conversion outcomes back per message or per range, and the provider's models correlate that with route-level signals to score destinations before the next campaign sends. This is a machine-learning problem in the narrow, useful sense — supervised scoring on labelled conversion outcomes — not a buzzword: the model ranks destination ranges by fraud probability and the routing layer throttles or challenges the tail.
The commercial defences that hold
- Rate-limit and challenge the request surface first — per-IP, per-device, per-number velocity caps and a CAPTCHA or proof-of-work step on resend flows. The cheapest million messages are the ones never sent.
- Destination caps in the contract — per-prefix and per-country daily ceilings with automatic cut-off, so a pumped range self-limits instead of running for a full billing cycle.
- Conversion-linked commercial terms — clawback clauses for traffic to ranges with conversion below an agreed floor, or pay-per-conversion pricing on verification traffic where the provider will offer it.
- Route transparency and audit rights — the contractual right to know which downstream partners touched traffic to a disputed range, which converts deniability into accountability.
- Holdback on anomalous corridors — settlement terms that delay payment on volume flagged by either side's models until conversion data lands.
Why operators should care as much as enterprises
It is tempting for an operator to treat AIT as someone else's problem — the traffic is billable and the termination revenue is real. The medium-term ledger says otherwise. AIT is the direct cause of the largest OTP senders migrating to flash calls, silent network authentication, and email; it triggers invoice disputes that sour wholesale relationships; and regulators increasingly read tolerated AIT as a consumer-protection failure. An operator whose inbound routes are known AIT channels is trading its A2P franchise for a few quarters of inflated volume. The fix sits in the same place as the rest of the fraud stack: behavioural models at the boundary that score inbound A2P per range and per sender, and partner-vetting discipline on the interconnects the traffic arrives through.
BroadNet runs conversion-correlated fraud scoring across the routes it operates and deploys the same models inside operator anti-fraud programmes. Enterprises can pair it with OTP delivery that reports conversion, not just delivery.